# services/harbor/hermes-webui-immutability-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: harbor-hermes-webui-immutability-ensure-1
  namespace: harbor
spec:
  backoffLimit: 2
  activeDeadlineSeconds: 600
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/agent-run-as-user: "65532"
        vault.hashicorp.com/agent-run-as-group: "65532"
        vault.hashicorp.com/role: harbor-policy-bootstrap
        vault.hashicorp.com/agent-inject-secret-harbor-admin-password: kv/data/atlas/harbor/harbor-core
        vault.hashicorp.com/agent-inject-template-harbor-admin-password: |
          {{- with secret "kv/data/atlas/harbor/harbor-core" -}}
          {{ .Data.data.harbor_admin_password }}
          {{- end -}}
    spec:
      serviceAccountName: harbor-policy-bootstrap
      enableServiceLinks: false
      restartPolicy: Never
      nodeSelector:
        hardware: rpi5
        kubernetes.io/arch: arm64
        node-role.kubernetes.io/worker: "true"
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/hostname
                    operator: NotIn
                    values: [titan-04, titan-14, titan-18, titan-19, titan-24]
      securityContext:
        fsGroup: 65532
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: ensure
          image: docker.io/library/python@sha256:efcdfa6a6b2fd2afb9c7dfa9a5b288a6f68338b5cfdebe6b637d986067d85757
          imagePullPolicy: IfNotPresent
          command: [python3, /scripts/harbor_hermes_webui_immutability_ensure.py]
          env:
            - name: HARBOR_API_ORIGIN
              value: https://registry.bstein.dev/api/v2.0
            - name: HARBOR_ADMIN_PASSWORD_FILE
              value: /vault/secrets/harbor-admin-password
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
            runAsGroup: 65532
            runAsNonRoot: true
            runAsUser: 65532
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: scripts
              mountPath: /scripts
              readOnly: true
            - name: tmp
              mountPath: /tmp
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: 250m, memory: 128Mi}
      volumes:
        - name: scripts
          configMap:
            name: harbor-hermes-webui-immutability-script
            defaultMode: 0555
        - name: tmp
          emptyDir: {}